vue-router-navigation-security-review

name

vue-router-navigation-security-review

description

Statically review Vue Router navigation guards, redirect flows, and template bindings for client-side guards used as the sole authorization boundary, open redirects via route.query.redirect/returnUrl, javascript:/data: scheme injection through dynamic :to/:href bindings, route params/query reaching v-html/innerHTML (reflected XSS), guard-induced redirect loops, and catch-all/history-mode misconfiguration, grounded in Vue Router's own documentation.

Vue Router Navigation Security Review

Purpose

Review Vue Router navigation guards, redirect flows, dynamic link bindings, and route configuration for the security-critical defect classes specific to client-side routing as a security surface — not general route-tree architecture, not component design, and not the state-store or SSR-hydration concerns owned by sibling skills. This skill exists to keep the review anchored to five documented defect classes: (a) a beforeEach/beforeEnter guard used as the sole authorization boundary with no server-side enforcement behind it, (b) open redirect via route.query.redirect/returnUrl passed unvalidated into router.push()/ window.location, (c) javascript:/data: scheme injection via a dynamic :to/:href binding, (d) route.params/route.query interpolated into v-html/innerHTML (reflected XSS through the router), and (e) next(unvalidatedPath)/guard-returned redirects creating loops or bypasses, overly-broad catch-all routes, and history-mode server misconfiguration. It does not re-litigate general route-tree/code-splitting architecture, Pinia/Vuex store security, or SSR cross-request pollution in every response.

When to use